CVE-2022-42124
HighCVSS 7.5Exploitation Probability (EPSS)
Elevated risk65th percentile - higher than 65% of all known CVEs
Summary
A ReDoS vulnerability in the LayoutPageTemplateEntryUpgradeProcess in Liferay Portal 7.3.2 through 7.4.3.4 and Liferay DXP 7.2 fix pack 9 through 18, 7.3 before update 4, and DXP 7.4 GA allows remote attackers to consume excessive server resources via a crafted payload injected into the 'name' field of a layout prototype.
Risk Assessment
An attacker can overload the server, causing a denial of service (DoS) and disrupting system operation for legitimate users.
Recommendation
It is recommended to immediately upgrade Liferay Portal to version 7.4.3.5 or later, and for DXP apply the appropriate fix pack or update as specified by the vendor.
Other vulnerabilities in Liferay Portal
See all- CVE-2010-5327High
Liferay Portal through 6.2.10 allows remote authenticated users to execute arbitrary shell commands via a crafted Velocity template.
- CVE-2022-42122Critical
A SQL injection vulnerability in the Friendly Url module in Liferay Portal 7.3.7 and Liferay DXP 7.3 fix pack 2 through update 4 allows attackers to execute arbitrary SQL commands via a crafted payload injected into the `title` field of a friendly URL.
- CVE-2022-42120Critical
A SQL injection vulnerability in the Fragment module in Liferay Portal 7.3.3 through 7.4.3.16, and Liferay DXP 7.3 before update 4, and 7.4 before update 17 allows attackers to execute arbitrary SQL commands via a PortletPreferences' `namespace` attribute.
- CVE-2020-7961CriticalActively exploited
Deserialization of untrusted data in Liferay Portal prior to 7.2.1 CE GA2 allows remote attackers to execute arbitrary code via JSON web services (JSONWS).
- CVE-2025-62267Medium
Multiple cross-site scripting (XSS) vulnerabilities in the web content template's select structure page in Liferay Portal 7.4.3.35 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 update 35 through update 92 allow remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a user's (1) First Name, (2) Middle Name, or (3) Last Name text field.
- CVE-2025-62264Medium
Reflected cross-site scripting (XSS) vulnerability in Languauge Override in Liferay Portal 7.4.3.8 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, and 7.4 update 4 through update 92 allows remote attackers to inject arbitrary web script or HTML via the `_com_liferay_portal_language_override_web_internal_portlet_PLOPortlet_selectedLanguageId` parameter.
- CVE-2025-62265Medium
Cross-site scripting (XSS) vulnerability in the Blogs widget in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92, 7.3 GA through update 36, and older unsupported versions allows remote attackers to inject arbitrary web script or HTML via a crafted <iframe> injected into a blog entry's "Content" text field. The Blogs widget in Liferay DXP does not add the sandbox attribute to <iframe> elements, which allows remote attackers to access the parent page via scripts and links in the frame page.
- CVE-2025-62266Medium
By default, Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and Liferay DXP 2024.Q1.1 through 2024.Q1.5, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions is vulnerable to DNS rebinding attacks, which allows remote attackers to redirect users to arbitrary external URLs. This vulnerability can be mitigated by changing the redirect URL security from IP to domain.
- CVE-2025-62257Medium
Password enumeration vulnerability in Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and Liferay DXP 2024.Q1.1 through 2024.Q1.5, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 92, and older unsupported versions allows remote attackers to determine a user's password even if account lockout is enabled via brute force attack.
- CVE-2025-62258Medium
A CSRF vulnerability in the Headless API of Liferay Portal and Liferay DXP allows remote attackers to execute any Headless API call via the `endpoint` parameter.
Original NVD description (English source)
ReDoS vulnerability in LayoutPageTemplateEntryUpgradeProcess in Liferay Portal 7.3.2 through 7.4.3.4 and Liferay DXP 7.2 fix pack 9 through fix pack 18, 7.3 before update 4, and DXP 7.4 GA allows remote attackers to consume an excessive amount of server resources via a crafted payload injected into the 'name' field of a layout prototype.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS